Prevent users from killing processes that they own

Question

I have started some processes (window based) from user's .bashrc file. I want to prevent users from killing those processes. Is there a way to transfer the process to superuser so that a normal user cannot kill it? Or is there a way of starting some process which is owned by super user himself?

Answer 1

You may built in a trap in your processes to prevent a normal kill (SIGINT). That would of course not work for a SIGKILL (-9). Such a trap would look like (bash):

trap "echo trapped" INT

To reset the trap you could use

trap - INT

Answer 2

Start a command as a different user is usually done with su, sudo or by setting the setuid bit in the permissions of the executable.

You do not want to have executables run as root unless they absolutely need to, as that user has all priviledges. If those processes don't need any priviledge, you can make them run as "nobody" which is the user whom we try to grant the least prviledges as possible.

A user has always the right to kill its own processes (as long as it's got access to the kill system call), or said otherwise, a process of a given effective uid has always the right to send a signal to a process running as the same effective uid.

Answer 3

Depends on what exactly you're doing, but your options are:

• Make the user able to run the program as a different user. You can do this via sudo, or via the setuid on the executable. Beware that with either of these, things other than the user's .bashrc will be able to start the program. (Note: both sudo and setuid can be users other than root, and should be if possible)
• Have the login system invoke the process (as root) before actually finishing the user login. The advantage here is that you're not granting any permissions to the user, and the user won't be able to get around it (via, e.g., editing or removing .bashrc, or switching shells, or...). One way appears to be pam_exec to hook into PAM. Your executable should drop root privileges if possible.